1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
|
From: Chris Liddell <chris.liddell@artifex.com>
Date: Tue, 5 Nov 2019 09:45:27 +0000
Subject: Bug 701841: remove .forceput from /.charkeys
Origin: https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=485904772c5f0aa1140032746e5a0abfc40f4cef
Bug: https://bugs.ghostscript.com/show_bug.cgi?id=701841
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2019-14869
When loading Type 1 or Truetype fonts from disk, we attempt to extend the glyph
name table to include all identifiable glyph names from the Adobe Glyph List.
In the case of Type 1 fonts, the font itself (almost always) marks the
CharStrings dictionary as read-only, hence we have to use .forceput for that
case.
But for Truetype fonts, the CharStrings dictionary is created internally and is
not read-only until *after* we have fully populated it (including the extended
glyph names from the AGL), hence there is no need for .forceput, and no need to
carry the security risk of using it.
Replace with regular put.
[Salvatore Bonaccorso: Backport to 9.26a: Drop last hunck removing
'executeonly' (hiding .forceput) as this was never added back in 9.26a. Thanks
to Marc Deslauriers for pointing this out]
---
Resource/Init/gs_ttf.ps | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/Resource/Init/gs_ttf.ps b/Resource/Init/gs_ttf.ps
index 74043d16b0cf..6be8fe9955cd 100644
--- a/Resource/Init/gs_ttf.ps
+++ b/Resource/Init/gs_ttf.ps
@@ -1304,7 +1304,7 @@ currentdict /.pickcmap_with_no_xlatmap .undef
TTFDEBUG { (\n1 setting alias: ) print dup ==only
( to be the same as ) print 2 index //== exec } if
- 7 index 2 index 3 -1 roll exch .forceput
+ 7 index 2 index 3 -1 roll exch put
} forall
pop pop pop
}
@@ -1322,7 +1322,7 @@ currentdict /.pickcmap_with_no_xlatmap .undef
exch pop
TTFDEBUG { (\n2 setting alias: ) print 1 index ==only
( to use glyph index: ) print dup //== exec } if
- 5 index 3 1 roll .forceput
+ 5 index 3 1 roll put
//false
}
{
@@ -1339,7 +1339,7 @@ currentdict /.pickcmap_with_no_xlatmap .undef
{ % CharStrings(dict) isunicode(boolean) cmap(dict) RAGL(dict) gname(name) codep(integer) gindex(integer)
TTFDEBUG { (\3 nsetting alias: ) print 1 index ==only
( to be index: ) print dup //== exec } if
- exch pop 5 index 3 1 roll .forceput
+ exch pop 5 index 3 1 roll put
}
{
pop pop
|
